Executive brief
Apache Airflow's Task SDK failed to mask secrets stored in Variables when the JSON value is a list, causing sensitive data to appear in plaintext in task logs and the Rendered Templates UI. Any authenticated user with access to task logs could view these exposed secrets without special configuration. This is a continuation of a prior incomplete fix and affects deployments that may have thought they were already protected.
Technical details
The vulnerability is a secret masking bypass in Apache Airflow's Task SDK. When a Variable contains a JSON value with a list at the top level, the deserialization logic failed to apply the masking filter (unlike dicts and strings, which were masked). Any authenticated user able to read task logs or the Rendered Templates UI could recover the unmasked secret values. This is the list-shaped counterpart of CVE-2026-59244, which only addressed the dict case, meaning prior upgrades against that CVE are insufficient. Patches are available in Apache Airflow 3.3.1 and later.
Affected products
- Apache Airflow before 3.3.1
Timeline
- 2026-08-12: disclosed
- 2026-08-04: patched: Fix merged in PR #70891; available in Airflow 3.3.1+